modiloader | 7deaeae5098cc6603dda870aea77b502fce103375c428a50aa02fa8b877ddca5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7deaeae5098cc6603dda870aea77b502fce103375c428a50aa02fa8b877ddca5
Size

1.5MB
MD5

7076d9925276d88098a8c840c47ac98a
SHA1

fc1edf290c5ebfa33a1bda39c81dd2f5969691f6
SHA256

7deaeae5098cc6603dda870aea77b502fce103375c428a50aa02fa8b877ddca5
SHA512

a5bcb859c60318ce5d0ffcd4134fcdfbe3e66652b821ba821d5d28b0768d1e724f8e64af29b843d40e49b25cdff25a7fc04d6ee25ee96bc8a88af2acca1d470e
SSDEEP

24576:KNO7JNzhycmAqLNW4z9se2+NHTWPkvNL2AtkxHKR0rTX62nf0ryxgAwXFz:KNOBbUWY1HTIklL2AtkxHKYX6G6yi/

Score

10^/10

modiloader

Malware Config

Signatures

ModiLoader Second Stage 1 IoCs

resource	yara_rule
sample	modiloader_stage2

Modiloader family
modiloader

Files

7deaeae5098cc6603dda870aea77b502fce103375c428a50aa02fa8b877ddca5
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 8KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ